GRC Engineer

Forward is looking for a GRC Engineer. GRC Engineering is a new discipline: instead of chasing down screenshots every quarter and hoping the auditor doesn't ask too many follow-up questions, you're building scripts and API integrations that pull evidence straight from the source systems and keep it current on their own. If you've spent any time reading about the field, you've probably run into grc.engineering, the GRC Engineering Club, or grcengineer.com. We'd rather hire someone who already thinks this way than someone who needs to be convinced of it; if your engineering skills enable doing more than a traditional GRC Analyst role, you're the right fit.

Your initial focus, likely for the next 6 months, is GRC Engineering: compliance automation, audit management (SOC 2, ISO 27001/42001), control design and testing, and risk management.

Once the most critical automations are in place, this job broadens to include a Security Operations piece: mostly SIEM and SOAR work plus whatever incident response comes up. This is your chance to go beyond mere exposure to SecOps work, to directly participate in alert triage, SIEM/SOAR administration and tuning, enforcement work, and incident response. This is a real split, and we're looking for someone who can grow to handle both types of work.

What You'll Do

GRC Engineering (main focus of role)

• Policy & Documentation: Write, maintain, and actively drive review cycles for security policies and procedures.
• Automated Control Testing: Build control tests that verify real system configurations directly at the source, rather than manual spreadsheets. If a control says MFA is enforced, you should be able to verify that in the identity provider yourself.
• Manage and extend our GRC platform (Vanta, Drata, etc.) using scripts and API integrations.
• Control Monitoring: Continuously manage control drift between audits and drive remediation to completion.
• Audit Management: Lead day-to-day SOC 2 Type II audits and lay groundwork for ISO 27001 and ISO 42001.
• Risk Management: Maintain a prioritized risk register and run actionable risk assessments.
• Handle vendor security reviews and due diligence: pull evidence from a vendor's API or trust page, rather than mailing them a 40-question spreadsheet.
• Engineering Collaboration: Integrate compliance requirements directly into engineering workflows, such as CI/CD, access provisioning, and change management.

Security Operations (additional piece after critical automations in place)

• SIEM & SOAR Admin: Tune detection rules, correlation logic, and response playbooks.
• Endpoint Support: assist with EDR, DLP, and endpoint break/fix and incident response cases.
• Alert Triage: Participate in security alert triage and documentation.
• Jump into incident response when something happens: investigation, helping contain it, and post-mortem write-ups.
• Feed what you see in the SOC back into the GRC side of your job. If operations tell a different story than what the compliance platform says, that gap is worth knowing about.

What We're Looking For

Required

• 3+ years in GRC, compliance, security engineering, IT audit, or equivalent, with on-the-job exposure to control design, risk assessment, AND compliance frameworks.
• Experience writing policies and procedures, with a focus on testable and verifiable outcomes.
• Time spent doing real work in a GRC/compliance automation platform (Vanta, Drata, Thoropass, Anecdotes, or similar).
• Solid working knowledge of SOC 2. ISO 27001 experience is a plus. ISO 42001 is a possible future endeavor, but curiosity about AI governance is important.
• Basic scripting knowledge: Python or Bash, SQL, and comfortable pulling data from an API, parsing a log file, or automating something you used to do by hand. This is not a software engineer role and you will be able to take advantage of AI to assist, but the ability to read, troubleshoot, and deliver working scripts is a requirement.
• Some exposure to SIEM/SOAR tooling (Splunk, Chronicle, Panther, XSOAR, Tines, whatever you've used) and a basic feel for how incident response actually runs.
• The ability to speak to an auditor and an engineer in languages they understand, as both the GRC and engineering skill sets will be utilized.
• A tolerance for ambiguity. "GRC Engineer" is an evolving field/role. We will be figuring out parts of this role as time goes on together.
• Experience with endpoint compliance in a Mac-centric environment.

Nice to Have

• We run in the cloud but also still operate our own data center, so comfort with straight Linux administration and scripting matters just as much as anything cloud-native. If you've worked with Terraform or policy-as-code, that helps too.
• Certs like Security+, CISA, CISSP, or ISO 27001 Lead Implementer/Auditor are fine to have. We just care more about whether you can trace a control back to the system it's actually describing.
• Time spent tuning or migrating a SIEM/SOAR setup, or running incident response for real, not just in a tabletop exercise.
• Understanding tabletop exercises, how to run them, how to conduct a post-mortem and how to drive the findings to completion with stakeholders.

The base pay range for this role is between $140,000 and $170,000. This range represents the low and high end of the salary for this position. Actual compensation will vary based on factors including location, candidate experience, skills, and level.